{"slug": "zcode-uploads-your-git-history-settings-do-nothing", "title": "ZCode Uploads Your Git History: Settings Do Nothing", "summary": "Security researcher ferstar published a reverse-engineering writeup showing that ZCode, the free GLM-5.2 coding agent from Z.ai, silently uploads a workspace's full git history to Alibaba Cloud's Aliyun OSS, with a 313MB encrypted archive from one commercial workspace containing 42,411 files of which 86.6% came from the .git directory. The capture sidecar starts unconditionally at login and checks only for a valid JWT token, so ZCode's two privacy toggles — \"Optimize Experience\" and \"Repo Snapshot Indexing\" — do not stop the upload, which triggers before every prompt and after every completed task at up to 62 upload events per session. ZCode uses envelope encryption with AES-256-CTR content keys wrapped via RSA-OAEP-SHA256 using a server-supplied public key, leaving users unable to decrypt archives that Z.ai can read; no official statement has been issued since the disclosure.", "body_md": "ZCode, the free GLM-5.2 coding agent from Z.ai, is silently packaging your entire git history and uploading it to Alibaba Cloud. A security researcher published the reverse-engineering proof today. The encrypted archive lands on Aliyun OSS using a key only Z.ai holds — meaning you cannot decrypt it yourself. And the two privacy settings ZCode provides do nothing to stop it.\n\nIf you installed ZCode and logged in at any point since July 2026, your complete repository lineage — every commit, every deleted secret, every binary asset cached in LFS — may already be on Z.ai’s cloud storage. Here is what the researcher found, why the settings are theater, and how to actually stop the upload.\n\n## What ZCode Is Actually Sending\n\nResearcher ferstar’s [reverse-engineering writeup](https://blog.ferstar.org/en/posts/zcode-silent-workspace-snapshot-upload/) analyzed a 313MB encrypted archive generated from a single commercial workspace: 42,411 files, 86.6% of which came from the .git directory. The breakdown is specific:\n\n- **.git/lfs/** — 196.1 MB (56.8%) — binary assets, LFS large file cache\n- **.git/objects/** — 102.2 MB (29.6%) — every commit ever made, including deleted content\n- **.git/logs/** — 0.6 MB (0.2%) — reflogs and branch history\n- **Source code and docs** — ~46.2 MB (13.4%)\n\nThis is not sending your current code for AI context. The .git/objects directory contains everything you have ever committed — rotated API keys that still live in history, unpushed branch content, internal hostnames from configurations you long forgot. ZCode triggers the capture before every prompt and after every completed task, generating up to 62 upload events per session. Moreover, failed uploads are queued and retried automatically — one analyzed session logged 564 failed upload attempts sitting in the retry queue.\n\n## Your Privacy Settings Don’t Stop the ZCode Upload\n\nZCode exposes two toggles that users would reasonably expect to control this behavior. However, neither works as advertised.\n\n“Optimize Experience” sounds like a telemetry opt-out. In reality, it only controls whether Z.ai is authorized to use your data for model training — the upload continues either way. “Repo Snapshot Indexing” sounds like it disables snapshots. It only controls whether Z.ai’s servers index the uploaded content after receiving it. According to [tokenstead.ai’s mitigation analysis](https://tokenstead.ai/guides/zcode-silent-git-history-upload), the capture sidecar starts unconditionally at login and checks only for a valid JWT authentication token — user preferences are never consulted.\n\nEarlier, a Z.ai executive posted publicly that the company would not implement “anything beyond what’s listed” on the ZCode website. Workspace snapshotting is not listed anywhere in the policy, FAQ, or changelog. No official statement has been issued since today’s disclosure. A ZCode team affiliate responded to ferstar’s post with “hey I am sorry to let you find it” — which the developer community on [Hacker News](https://news.ycombinator.com/item?id=49752422) read as confirmation, not denial.\n\n## The Key Z.ai Holds\n\nThe encryption architecture makes the concern concrete. ZCode uses envelope encryption: AES-256-CTR for archive content, with the symmetric key wrapped using RSA-OAEP-SHA256. The RSA public key is supplied dynamically by Z.ai’s servers at upload time. The private key never touches your machine.\n\nYou have a multi-hundred-megabyte ciphertext sitting on your local disk. You cannot open it. Z.ai can. As ferstar put it: *“A key that only the server can use serves exactly one purpose: making sure the server can read your code whenever it wants.”* This is not a user-side backup feature — it is a collection architecture. Furthermore, if you have previously read ByteIota’s coverage of [ZCode and China’s intelligence law](https://byteiota.com/zcode-glm-52-china-data-risk/), the encryption setup makes that legal exposure considerably more concrete: the data that law could reach is now decryptable on demand.\n\n## How to Actually Stop the Upload\n\nDeleting the checkpoints directory does not help — ZCode recreates it within 30 minutes and resumes uploads. The only reliable fix is making the directory immutable at the OS kernel level, blocking ZCode’s writes entirely.\n\n**macOS:**\n\n```\nrm -rf ~/.zcode/v2/checkpoints\nmkdir -p ~/.zcode/v2/checkpoints\nchflags uchg ~/.zcode/v2/checkpoints\n```\n\n**Linux:**\n\n```\nrm -rf ~/.zcode/v2/checkpoints\nmkdir -p ~/.zcode/v2/checkpoints\nsudo chattr +i ~/.zcode/v2/checkpoints\n```\n\nThis prevents kernel-level writes to the checkpoints directory. ZCode’s core chat and autocomplete remain functional. The checkpoint rollback UI becomes unavailable — a reasonable trade-off. To reverse the lock: `chflags nouchg` on macOS or `sudo chattr -i` on Linux.\n\nFor teams with stricter compliance requirements: GLM-5.2 carries an MIT license. Self-hosting the model on your own infrastructure eliminates the data problem entirely — an option neither Cursor nor Claude Code can offer. ByteIota’s earlier [ZCode developer guide](https://byteiota.com/zcode-developer-guide-glm-5-2-free-trial-data-risks/) covers the self-hosting path in detail.\n\n## Key Takeaways\n\n- ZCode uploads your entire .git history to Alibaba Cloud — not just current code context — including deleted secrets, unpushed branches, and binary LFS caches\n- The “Optimize Experience” and “Repo Snapshot Indexing” toggles do not stop the upload; they control only training authorization and server-side indexing\n- The archive is encrypted with a key held exclusively by Z.ai’s servers — you cannot decrypt your own data\n- Fix: Use `chflags uchg` (macOS) or`sudo chattr +i` (Linux) on`~/.zcode/v2/checkpoints` — core functionality survives\n- Z.ai has not issued a statement; a team affiliate’s response amounted to implicit confirmation", "url": "https://wpnews.pro/news/zcode-uploads-your-git-history-settings-do-nothing", "canonical_source": "https://byteiota.com/zcode-uploads-your-git-history-settings-do-nothing/", "published_at": "2026-09-18 14:09:46+00:00", "updated_at": "2026-09-18 14:24:40.491823+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-policy", "ai-tools", "ai-products"], "entities": ["ZCode", "Z.ai", "ferstar", "Alibaba Cloud", "Aliyun OSS", "GLM-5.2", "Hacker News", "tokenstead.ai"], "alternates": {"html": "https://wpnews.pro/news/zcode-uploads-your-git-history-settings-do-nothing", "markdown": "https://wpnews.pro/news/zcode-uploads-your-git-history-settings-do-nothing.md", "text": "https://wpnews.pro/news/zcode-uploads-your-git-history-settings-do-nothing.txt", "jsonld": "https://wpnews.pro/news/zcode-uploads-your-git-history-settings-do-nothing.jsonld"}}